Gresham-Barlow School District Data Breach Notice (Oregon Attorney General)

The Gresham-Barlow School District notified 9,629 Oregon residents that their personal information was exposed in an incident that occurred on December 21, 2024. The district filed the notice with the Oregon Department of Justice on March 12, 2025 — an interval of 81 days.

Personal information exposed carries long-term risk

If you received a notification letter from the district, your records were among those involved. The filing lists personal information as the category exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the disclosed categories.

That absence is meaningful. Without those higher-value identifiers, the immediate risk of new account fraud or tax-related identity theft is lower than in many breaches. However, names combined with addresses, dates of birth, or student-related details still retain value for identity thieves. They can be used to craft convincing phishing messages, support synthetic identity applications, or answer security questions on other accounts you already hold.

What the 81-day gap tells you

The incident date and the filing date are both public. The 81 days between December 21, 2024 and March 12, 2025 represent the period from the district’s recorded incident to formal notification. Notification timelines vary by the complexity of the investigation and by state requirements. This gap is the single most concrete new fact in the filing.

The district is required to notify affected individuals directly, usually by mail to the last known address. If you have not received a letter, it is likely your information was not included. Anyone who has moved since December 21, 2024 should contact the district directly to confirm whether their records were affected.

The difference between what can and cannot be changed

Because the exposed category is limited to personal information and contains no reissuable credentials or financial instruments, the permanent damage is smaller than in breaches that include Social Security numbers or full financial profiles. You cannot change your name, date of birth, or past addresses, but those pieces alone are less useful to criminals without additional identifiers.

The absence of exposed passwords is also significant. There is no need to reset any Gresham-Barlow account password in response to this incident. Doing so would be unnecessary work. The real exposure concerns how your personal details might be combined with information already available from other sources.

How this exposure typically gets used

Thieves rarely use a single breach in isolation. They combine records across multiple incidents to build fuller profiles. A name and address from this filing, paired with a date of birth from elsewhere, can help bypass customer-service verification or strengthen phishing emails that appear to come from the school district.

Student or family records often include contact details that remain current for years. This makes the information useful for long-term targeting rather than immediate financial fraud. The value decays more slowly than credit card numbers but faster than a Social Security number.

Practical steps that address this specific exposure

• Watch for unexpected contact from the district or anyone claiming to represent it. Verify requests for information by calling the district using a number you locate yourself rather than one provided in an email or letter.
• Review your credit reports for unfamiliar inquiries. Even without Social Security numbers exposed, identity thieves sometimes attempt to use partial personal details. Order free weekly reports at AnnualCreditReport.com.
• Place a fraud alert with one of the three major credit bureaus. A 90-day fraud alert requires creditors to verify your identity before opening new accounts in your name. It is free and easy to set.
• Be cautious with school-related communications. Treat any request for personal or student information with extra skepticism if it arrives outside normal channels.
• Keep records of the notification letter. Save a copy with the dates and reference numbers. It will be useful if you later need to dispute fraudulent activity traced to this incident.

The filing does not disclose the method of the breach or whether data was confirmed stolen. It states only that personal information was exposed and that 9,629 individuals were affected. The letter you may have received is the only reliable way to know whether your specific records were included.